WebApp Sec: Re: "Forgot Password" function

["Kevin Spett" <kspett () spidynamics com>]

> The simple solution to this problem is to actually generate a new
> password for the user and email them that instead and force them to
> change it on the first login. That achieves a few security goals:
This does nothing to defend against the scenario I wrote about earlier in
this thread.  You can read it here:
http://archives.neohapsis.com/archives/sf/www-mobile/2002-q4/0020.html

To reiterate, unencrypted email offers no garauntee of privacy or
authenticity.

Kevin Spett
SPI Labs
http://www.spidynamics.com/